A city SOC must inventory vendor-hosted AI endpoints used by departments using only authorized public OSINT. Which activity best fits that recon objective?
Select an answer to reveal the explanation.
Short Explanation
OSINT is reading the city’s open bulletin boards—docs, status pages, job ads—before you ever knock on a locked door. You’d be surprised how many “hidden” AI endpoints wave from the public sidewalk.
Full Explanation
Authorized AI reconnaissance for a city SOC inventoring vendor-hosted endpoints with only public OSINT reviews documentation, developer portals, status pages, procurement notices, job postings, and exposed API references that reveal departmental AI services. Those sources build an inventory without unauthorized intrusion and feed threat profiling and later scoped testing under rules of engagement. Municipal SOCs should treat public artifacts as first-pass discovery before any invasive technique.
Querying internal ticketing systems and CMDB exports to list approved departmental AI subscriptions relies on internal records that are not public OSINT, so it violates the public-only constraint. Scanning vendor netblocks with active port probes is active, intrusive network scanning rather than passive public OSINT, and it exceeds the authorized public-only recon scope. Reviewing vendor press releases and marketing blogs yields high-level leadership summaries, not the specific departmental AI endpoint inventory that public OSINT recon requires.
Exam caveat: OSINT recon uses public artifacts only—internal ticketing/CMDB lookups, active netblock scanning, and marketing summaries are wrong for this public-only discovery task. Operational check: systematically collect public docs/status/jobs/API refs into an AI asset inventory; validate findings with department owners; promote candidates into scoped MoU testing; never rely on internal ticketing/CMDB exports, active port scans, or press-release summaries for public-only recon.